versioning-skills
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses standard Git commands (
git init,git add,git commit,git diff) to manage file history. These operations are restricted to the local development environment (/home/claude/) and do not involve unauthorized network access or external repositories. - [SAFE]: Data handling follows best practices for the target environment. The skill correctly identifies the use of
/mnt/user-data/for user-provided uploads and generated outputs. It includes specific instructions to exclude sensitive version control metadata (.gitdirectories) when packaging the final skill using thezip -xflag. - [SAFE]: The skill implements a token-efficiency strategy by directing command outputs (specifically
git diff) to files rather than displaying them directly in the chat. This prevents potential context-window saturation issues while maintaining the agent's ability to provide the user with links to the relevant data. - [INDIRECT_PROMPT_INJECTION]: The skill includes instructions for processing and comparing user-uploaded zip files (
unzip /mnt/user-data/uploads/skill-v1.zip). While this introduces an attack surface where malicious content could be placed within a zip file, the skill handles this data using standard system tools for the intended purpose of code comparison, which is the primary function of the skill. No evidence of unsafe interpolation or exploitation was found.
Audit Metadata